5312dc6bd5
roles/common: use common nftables task
...
Use a common nftables task on Debian and Ubuntu.
2025-01-27 23:05:38 +03:00
d6e060d3af
roles/common: simplify firewall tasks
...
Apply firewall tag to included tasks, then we don't need to use a
block.
2025-01-27 22:30:50 +03:00
b873af004a
roles/common: single firewall task include
...
Use one include from the main tasks file.
2025-01-27 22:28:27 +03:00
c31e447861
roles/nginx: update signing key
2024-06-25 08:11:59 +03:00
6dc2ea36b6
roles/nginx: fix path to php 8.2 socket
2023-09-11 19:55:24 +03:00
af71a9b5f8
roles/php-fpm: remove fmt strings
...
Ansible confuses them for jinja2 tokens.
2023-09-11 19:52:18 +03:00
4dd57803e2
roles/php-fpm: fix user/group for php 8.2 configs
2023-09-11 19:51:59 +03:00
18d4245fc0
roles/common: fix tarsnap signing of apt repo
2023-09-11 19:37:49 +03:00
20dbe61fe1
roles/mariadb: use MariaDB 10.11
...
The server has already been updated from 10.6 to 10.11.
See: https://mariadb.com/kb/en/upgrading-from-mariadb-10-6-to-mariadb-10-11/
2023-09-10 22:53:10 +03:00
06416a3b64
roles: run ansible-lint --write
2023-08-23 22:22:51 +03:00
7a9a24ef5d
roles/common: rework fail2ban again
...
Actually, we do want to run fail2ban on all hosts because the sshd
monitoring via systemd is nice. At the very least it reduces spam
from failed logins in our systemd journal.
2023-08-23 22:15:24 +03:00
067adcd9f5
roles/common: rework fail2ban tasks
...
We can only run fail2ban when we have logs to monitor. When a host
is running Caddy we don't have logs, so fail2ban doesn't have any-
thing to monitor out of the box. For now I will restrict the task
to hosts running nginx.
2023-08-23 21:59:28 +03:00
84d210cfab
roles/common: re-format handlers
...
Use the newer Ansible format.
2023-08-23 21:35:28 +03:00
17736a4f14
roles/common: run ansible-lint --write
2023-08-23 21:33:22 +03:00
b9e91c4a3d
roles/common: minor updates to tarsnap task
...
Use modern Ansible task format
2023-08-23 21:20:22 +03:00
51c95e5d4c
roles/common: update tarsnap task
...
Update tarsnap task to use apt signed-by for package signing keys
instead of adding keys directly to apt-key.
2023-08-23 21:18:27 +03:00
8dbec29d2a
roles/nginx: prepare letsencrypt task for Debian 12
2023-08-23 21:01:12 +03:00
d3bf3dab04
roles/php-fpm: add support for PHP 8.2
...
This is used in Debian 12.
2023-08-23 20:56:35 +03:00
e86ccc9979
roles/nginx: minor rework of apt key stuff
2023-08-22 21:33:19 +03:00
14d57fc477
roles/nginx: reformat main tasks
2023-08-10 22:44:47 +02:00
5c39f1abd8
roles/common: minor changes to Debian sshd_config files
2023-08-10 22:10:04 +02:00
6794eb0432
roles/common: default to disabling SSH passwords
2023-08-10 22:09:03 +02:00
b106f9d9e5
roles/common: ignore apt sources.list on Scaleway
...
While testing Debian 12 on Scaleway I noticed their apt sources.list
is in some weird format I've never seen before, so let's skip it on
those hosts.
2023-08-10 08:08:42 +02:00
d280859b0d
roles/common: minor updates to Debian 11 sshd_config
2023-08-09 21:55:04 +02:00
bca1629d2f
Minor comment updates for Debian 12
2023-08-09 21:51:53 +02:00
4fa82faf18
roles/common: adjust sshd_config for Debian 12
...
Adjust sshd_config based on ssh-audit profile for OpenSSH 9.2.
2023-08-09 21:27:19 +02:00
b8f0b4b1fb
roles/common: add vanilla sshd_config for Debian 12
2023-08-09 21:16:50 +02:00
446d402778
roles: minor fix to Debian version comparisons
2023-07-27 18:48:07 +03:00
fdb9a75489
roles/common: update tarsnap GPG key
2023-04-14 10:09:11 -07:00
c840ffe018
roles/caddy: improve vhost template
...
Support domain aliases that redirect to the main domain and allow
sites to say they are static sites where they only need a document
root.
2022-11-13 18:54:03 +03:00
4867d6da6a
Add basic caddy role
2022-11-02 22:29:30 +03:00
bc8c030700
roles/common: update Tarsnap GPG key
2022-11-02 22:11:37 +03:00
b663d27fd8
roles/common: rework firewall_Debian.yml playbook
...
Use newer Ansible task format, move from apt to package module, and
do package installs in one transaction using a list instead of a
loop.
2022-09-12 17:25:40 +03:00
67c99dacf6
roles/common: rework firewall_Ubuntu.yml playbook
...
Use newer Ansible task format, move from apt to package module, and
do package installs in one transaction using a list instead of a loop.
2022-09-12 17:18:33 +03:00
b259f09cbd
roles/common: add SSH public key from other machine
2022-09-12 17:06:31 +03:00
f4b32e516b
roles/mariadb: use newer Ansible task syntax
2022-09-12 10:16:42 +03:00
fcb12ecee0
roles/mariadb: remove sources.list template
2022-09-12 10:13:27 +03:00
5bc03ceacc
roles/mariadb: install packages in single transaction
...
Using a list we can install these in a single apt transaction. Also
use the newer task format.
2022-09-12 10:12:07 +03:00
c317429f6d
roles/mariadb: rework package signing key and repo
2022-09-12 10:09:41 +03:00
b512a7f765
roles/common: create /etc/apt/keyrings
...
According the the Debian docs for third-party repositories we must
create this manually on distros before Debian 12 and Ubuntu 22.04.
This is due to changes in apt-secure and the deprecation of apt-key.
See: https://wiki.debian.org/DebianRepository/UseThirdParty
2022-09-12 10:05:12 +03:00
e3a87d4f79
roles/mariadb: MariaDB 10.6
...
See: https://mariadb.com/kb/en/mariadb-1069-release-notes/
See: https://mariadb.com/kb/en/upgrading-from-mariadb-105-to-mariadb-106/
2022-09-12 09:25:46 +03:00
34be0013b7
Remove Debian 10 support
2022-09-11 09:21:08 +03:00
399585f4e7
roles: don't compare literal true and false
...
I changed these yesterday when editing the truthy values, but acco-
rding to ansible-link we can just rely on them being true or false
without comparing.
2022-09-11 08:41:25 +03:00
0240897b1b
Remove Ubuntu 18.04 support
2022-09-10 23:30:04 +03:00
1da0da53ec
roles: use longer format for when conditionals
...
When the condition is an AND we can use this more succinct format.
2022-09-10 23:12:49 +03:00
677cc9f160
roles/php-fpm: fix truthy-ness in when
2022-09-10 23:12:26 +03:00
ffe7a872dd
roles: strict truthy values
...
According to Ansible we can use yes, true, True, "or any quoted st-
ring" for a boolean true, but ansible-lint wants us to use either
true or false.
See: https://chronicler.tech/red-hat-ansible-yes-no-and/
2022-09-10 22:33:19 +03:00
fc0fcc5742
roles/common: fix unnamed blocks
2022-09-10 18:35:27 +03:00
587bd6dcdd
roles: use fully qualified module names
2022-09-10 18:35:27 +03:00
a2d61abba2
roles/mariadb: update mirror
...
I started getting 'does not have a Release file' for the old repo-
sitory. Not sure why.
2022-08-14 22:09:47 -07:00
